What does s point to? The memory allocated by strdup. How much memory did strdup allocate? 1 byte. strcat, strcpy, etc, do not allocate memory, they just write to the buffer you provide. So strcat is writing past the end of your buffer. If you change the strdup call to s=malloc(1024) (and then set s[0]=0) then it will work.
Dan East
